Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/26/2007
04:53 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

SIM/Net Management Combo on Tap

eIQnetworks is about to release a new tool that integrates security and network management info

eIQnetworks on Monday will roll out a combination security information management (SIM)/network management platform that aims to bring the two worlds closer together, Dark Reading has learned.

The eIQnetworks new SecureVue software's arrival is timely: SIM technology is not only integrating more closely with traditional security tools, but it is also in the early stages of blending with traditional network operations tools, according to a new report by The 451 Group. (See Report: SIM Market to Heat Up and Blurring the Line Between SOC & NOC.)

While most organizations have no intention of combining their SOCs and NOCs, many are feeling pressure to get the two to communicate and share information better, often for compliance reasons. But integrating these traditionally separate worlds with their point solutions isn't easy -- it can be a costly, manually intensive task just to get to the bottom of a network event.

"There is too much time and money today spent in integrating these products," says Vijay Basani, co-founder and CEO of eIQnetworks. "Our goal is to define the incidents and necessary data to get to the bottom of an issue very quickly, with an overall cost benefit."

SecureVue encompasses SIEM, asset, configuration, performance, and vulnerability assessment functions, the company says. The SIEM features include real-time views of log management and forensics, and the asset and configuration components handle the typical management of hardware and software, as well as configurations for change control best practices. There is a performance analytics, and a vulnerability assessment piece centrally manages vulnerability scanners such as eEye Digital Security's Retina, ISS Scanner, and Nessus.

IPkey, a managed security services provider for small- to medium-sized businesses, has been beta-testing SecureVue and plans to purchase the tool. The company is looking at whether the multi-function product can replace its IPSwitch WhatsUp Professional network management tool, too.

Marcus Clarke, president of IPkey, says the possibility of consolidating the company's separate security and network management systems is attractive. "If we had a worm attack, for example, and we saw large amounts of bandwidth from a particular server of PC, we can't correlate those things automatically right now," he says. "SecureVue would let us do that."

Another benefit would be reducing the manpower it takes to run IPkey's redundant, co-location sites with two tools. "We have two separate physical facilities, so we double everything we do." And IPkey's technicians have to integrate any security and network issues "in their heads" now, he says, so the integration would save on manpower as well. IPkey runs eIQnetworks' Security Analyzer for monitoring security events.

"Correlation is a biggie for us," Clarke says. "That would give us the ability to develop some intelligence in our software and systems."

SecureVue is now shipping and runs on Windows and Linux. The central server component doesn't yet support Linux, but the regional and collection servers do. Pricing starts at $49,000.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • eIQnetworks Inc.
  • The 451 Group Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    News
    Inside the Ransomware Campaigns Targeting Exchange Servers
    Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
    Commentary
    Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
    Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    2021 Top Enterprise IT Trends
    We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
    Flash Poll
    How Enterprises are Developing Secure Applications
    How Enterprises are Developing Secure Applications
    Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-27905
    PUBLISHED: 2021-04-13
    The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To...
    CVE-2021-29262
    PUBLISHED: 2021-04-13
    When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be rea...
    CVE-2021-29425
    PUBLISHED: 2021-04-13
    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "...
    CVE-2021-29943
    PUBLISHED: 2021-04-13
    When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
    CVE-2021-28938
    PUBLISHED: 2021-04-13
    Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before 7.11.2-23.0 can leak user information across thread contexts. This occurs in opportunistic circumstances when there is concurrent query exec...